Shrug2 ransomware

Shrug2, which calls itself ShrugTwo, is the second generation of the Shrug .NET ransomware, seen in July 2018. It encrypts files on the C: drive with AES-256 and appends .SHRUG2 to their names; there is no text note, only a lock window asking $70 in Bitcoin and giving three days before every encrypted file is permanently deleted, plus a desktop shortcut named @ShrugDecryptor@. The random key and IV are uploaded to its server and also stored in the registry under HKCU\ShrugTwo until the deadline, when the files and that key are wiped. Do not reboot, clean or run removal tools on the PC: keep it powered and offline and have the registry key exported or the disk imaged first. The first build is covered on the Shrug page.

Sources: ID Ransomware, Quick Heal

File extensions: .SHRUG2

Decryptor: No public decryptor was found. Checked 2026-10-30.

Specific to this strain: No free tool exists, but Shrug2 keeps its random AES-256 key and IV under HKCU\ShrugTwo until its countdown ends, when it deletes the encrypted files and the key. Inside that window an incident responder may be able to capture the key: do not reboot or clean the PC first.

Sources: ID Ransomware